They're not claiming the certificates were compromised because of their own practices, in fact they repeatedly emphasise that there was no issue on their end.

I'm not questioning that the certificates became compromised the moment they sent them via email, or really the moment they generated and stored them given the level of security competence they've shown thus far.